CVE-2026-58263 Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier
Attackers can bypass the HTML sanitizer to inject malicious scripts that execute automatically when the editor content is rendered.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-58263?
CVE-2026-58263 is a high-severity cross-site scripting vulnerability in xdan jodit, published on 1 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. In versions prior to 4.12.28, the built-in clean-html sanitizer can be bypassed by a MathML/<style> carrier that hides a dangerous element from the sanitizer's element walk, so a no-interaction event handler survives into the editor value, potentially causing Mutation XSS. When an application supplies attacker-influenced HTML to the editor's value-set or insertion paths, the sanitized output still contains a live <img ... onload=...> (or another non-onerror handler such as onfocus). A consumer that renders that output (element.innerHTML = editor.value) executes the handler with no user interaction. This issue has been fixed in version 4.12.28.
Which versions are affected by CVE-2026-58263?
2 open source packages ship an affected version, including jodit.
| Package | Affected | Fixed in |
|---|---|---|
jodit npm | All versions | 4.12.28 |
jodit npm | All versions | 4.12.28 |
How do I fix CVE-2026-58263?
Upgrade jodit to 4.12.28 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-58263 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-58263 exists.
Sources
Also known as GHSA-rxcw-mc6f-6hr3.